# App-secret requirements

> Generate app secrets and use protected entry for external credentials.

- Canonical page: https://docs.userland.fun/guides/secrets/
- Docs index for agents: https://docs.userland.fun/llms.txt

> **For agents:** Read the [complete native guide](/native-guide.md) and current `context.get` capabilities. Use only implemented operations and preserve exact Account, app and environment authority.

Declare generated app-secret requirements alongside `apps.apply`, for example `{"name":"SESSION_SECRET","ensure":"generated","bytes":32}`. The platform generates and stores the value without exposing it to source, an agent transcript or browser code. Redeployments preserve the owned revision.

An external secret uses `ensure:external` with the provider and purpose. A waiting operation returns a protected browser action for the authorized person. It is a real dependency, unlike an automatically generated session secret. Continue the same operation after entry; do not invent a value or ask the person to paste it into chat.

Rotation, deletion and copying a secret are explicit privileged actions with current app/epoch/revision checks. The APIs return metadata, never plaintext. Changing a binding invalidates stale execution/preview authority and prior verification assumptions. A stopped app can retain encrypted secrets; deletion policy is separate from execution control.